CVE-2017-7670: Apache Traffic Control Slowloris-style Denial of Service Vulnerability
Summary
CVE-2017-7670: Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack. Affects github.com/apache/trafficcontrol across 5 version ranges.
>= 0.0.0, < 1.1.4-0.20170531185407-738c10fa1b58
< 0.0.0-20170531185407-738c10fa1b58
>= 1.1.4, < 1.8.1
>= 2.0.0-RC0, < 2.0.0
>= 2.1.0-RC0, < 2.1.0-RC1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Traffic Control is an incubating project that provides a set of tools for managing and delivering large-scale content delivery networks (CDNs). It includes components such as Traffic Router, which handles DNS requests. This vulnerability affects Traffic Router and can lead to a Slowloris-style Denial of Service attack.
Vulnerability Detail
The vulnerability arises from TCP connections made on the configured DNS port remaining in the ESTABLISHED state indefinitely until the client explicitly closes the connection or Traffic Router is restarted. If the number of connections in the ESTABLISHED state matches the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. As a result, Traffic Router is unable to service any DNS request, regardless of the transport protocol. This vulnerability can be exploited to cause a denial of service, impacting the availability of the Traffic Router component.
How To Fix
Latest published version: v7.0.1+incompatible as of 23 Oct 2026
go get github.com/apache/trafficcontrol@v7.0.1+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.0.0-20170531185407-738c10fa1b580.0.0-20170531185407-738c10fa1b58go get github.com/apache/trafficcontrol@v0.0.0-20170531185407-738c10fa1b58 -
>= 0.0.0, < 1.1.4-0.20170531185407-738c10fa1b581.1.4-0.20170531185407-738c10fa1b58go get github.com/apache/trafficcontrol@v1.1.4-0.20170531185407-738c10fa1b58 -
>= 1.1.4, < 1.8.11.8.1go get github.com/apache/trafficcontrol@v1.8.1 -
>= 2.0.0-RC0, < 2.0.02.0.0go get github.com/apache/trafficcontrol@v2.0.0 -
>= 2.1.0-RC0, < 2.1.0-RC12.1.0-RC1go get github.com/apache/trafficcontrol@v2.1.0-RC1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Apache Traffic Control project is vulnerable to a Slowloris-style Denial of Service attack in its Traffic Router component. Upgrading to the fixed versions of Apache Traffic Control is necessary to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/apache/trafficcontrol →
FAQ
Apache Traffic Control is an incubating project that provides a set of tools for managing and delivering large-scale content delivery networks (CDNs). It includes components such as Traffic Router, which handles DNS requests.
A Slowloris-style Denial of Service attack is a type of attack where an attacker sends a large number of partial HTTP requests to a target server, keeping the connections open for as long as possible. This exhausts the server's resources, preventing it from serving legitimate requests.
This vulnerability can be exploited to cause a denial of service, impacting the availability of the Traffic Router component in Apache Traffic Control.
To fix this vulnerability, users should upgrade to the fixed versions of Apache Traffic Control. For versions 1.8.0 and 2.0.0-RC0, the fixed versions are 1.8.1 and 2.0.0, respectively. For version 2.1.0-RC0, the fixed version is 2.1.0-RC1. Users can obtain the fixed versions from the official Apache Traffic Control repository.
There is no specific workaround mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/apache/trafficcontrol.
